Matthew Wilcox (Oracle) 07378b0991 xarray: Fix early termination of xas_for_each_marked
commit 7e934cf5ace1dceeb804f7493fa28bb697ed3c52 upstream.

xas_for_each_marked() is using entry == NULL as a termination condition
of the iteration. When xas_for_each_marked() is used protected only by
RCU, this can however race with xas_store(xas, NULL) in the following
way:

TASK1                                   TASK2
page_cache_delete()         	        find_get_pages_range_tag()
                                          xas_for_each_marked()
                                            xas_find_marked()
                                              off = xas_find_chunk()

  xas_store(&xas, NULL)
    xas_init_marks(&xas);
    ...
    rcu_assign_pointer(*slot, NULL);
                                              entry = xa_entry(off);

And thus xas_for_each_marked() terminates prematurely possibly leading
to missed entries in the iteration (translating to missing writeback of
some pages or a similar problem).

If we find a NULL entry that has been marked, skip it (unless we're trying
to allocate an entry).

Reported-by: Jan Kara <jack@suse.cz>
CC: stable@vger.kernel.org
Fixes: ef8e5717db01 ("page cache: Convert delete_batch to XArray")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-17 10:50:18 +02:00
..
2019-09-20 09:06:26 -07:00
2018-08-22 10:52:48 -07:00
2018-10-12 09:17:46 +02:00
2019-07-25 15:47:37 +02:00
2018-08-16 12:14:42 -07:00
2018-08-22 10:52:48 -07:00
2019-07-12 15:13:55 -07:00
2017-02-24 17:46:57 -08:00
2019-09-24 15:54:08 -07:00
2018-10-16 13:45:44 +02:00
2019-07-11 15:17:41 -07:00
2018-06-27 18:58:49 +03:00
2018-10-15 16:31:29 -04:00
2019-05-06 11:12:09 -07:00
2017-08-15 09:02:07 -07:00